MEDIUM 6.1 GitHub
CVE-2026-49446
Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel
### Summary
The Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to the upstream handler before the request's `x-cosmos-user`, `x-cosmos-role`, `x-cosmos-user-role`, and `x-cosmos-mfa` headers are stripped at lines 68-72, and before the `AdminOnlyWithRedirect` gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends `x-cosmos-user: admin` to a proxied backend; the documented forward-auth integration treats the caller a
Affected Products
- go/github.com/azukaar/cosmos-server <= 0.22.18
References
- https://github.com/advisories/GHSA-2rx5-2g7j-2659
- https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659
- https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19
- https://github.com/advisories/GHSA-2rx5-2g7j-2659
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-07-28 via GitHub. Affected: go/github.com/azukaar/cosmos-server <= 0.22.18.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.